dshb-auth 0.0.1

package/lib/credentials.js

@@ -0,0 +1,121 @@
+import { chmodSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
+//#region src/credentials.ts
+function dshHome() {
+	return process.env.DSH_HOME ?? join(homedir(), ".dsh");
+}
+function authFilePath() {
+	return join(dshHome(), "dshb", "web-auth.json");
+}
+function sanitizeUsername(input) {
+	return input.replace(/[\x00-\x1f\x7f]/g, "").trim();
+}
+var CredentialStore = class {
+	data = null;
+	loaded = false;
+	loadedMtime = 0;
+	file() {
+		return authFilePath();
+	}
+	maybeReload() {
+		if (!this.loaded) {
+			this.load();
+			return;
+		}
+		try {
+			if (statSync(this.file()).mtimeMs !== this.loadedMtime) this.load();
+		} catch {
+			this.data = null;
+		}
+	}
+	isInitialized() {
+		this.maybeReload();
+		return this.data !== null;
+	}
+	get username() {
+		this.maybeReload();
+		return this.data?.username ?? null;
+	}
+	get sessionSecret() {
+		this.maybeReload();
+		return this.data ? Buffer.from(this.data.sessionSecret, "base64") : null;
+	}
+	register(username, password) {
+		this.maybeReload();
+		if (this.data) throw new Error("auth: already initialized");
+		const salt = randomBytes(16);
+		const hash = scryptSync(password, salt, 64);
+		this.data = {
+			username,
+			salt: salt.toString("base64"),
+			hash: hash.toString("base64"),
+			sessionSecret: randomBytes(32).toString("base64")
+		};
+		this.save();
+	}
+	verify(password) {
+		this.maybeReload();
+		if (!this.data) return false;
+		const hash = scryptSync(password, Buffer.from(this.data.salt, "base64"), 64);
+		const expected = Buffer.from(this.data.hash, "base64");
+		return timingSafeEqual(hash, expected);
+	}
+	changePassword(username, password) {
+		this.maybeReload();
+		if (!this.data) throw new Error("auth: not initialized");
+		const salt = randomBytes(16);
+		this.data = {
+			username,
+			salt: salt.toString("base64"),
+			hash: scryptSync(password, salt, 64).toString("base64"),
+			sessionSecret: randomBytes(32).toString("base64")
+		};
+		this.save();
+	}
+	changeUsername(username) {
+		this.maybeReload();
+		if (!this.data) throw new Error("auth: not initialized");
+		this.data = {
+			...this.data,
+			username,
+			sessionSecret: randomBytes(32).toString("base64")
+		};
+		this.save();
+	}
+	load() {
+		this.loaded = true;
+		const file = this.file();
+		try {
+			this.loadedMtime = statSync(file).mtimeMs;
+			const parsed = JSON.parse(readFileSync(file, "utf8"));
+			if (parsed.username && parsed.salt && parsed.hash && parsed.sessionSecret) this.data = parsed;
+		} catch {
+			this.data = null;
+		}
+	}
+	save() {
+		const file = this.file();
+		mkdirSync(join(file, ".."), {
+			recursive: true,
+			mode: 448
+		});
+		const tmp = `${file}.${process.pid}.tmp`;
+		writeFileSync(tmp, JSON.stringify(this.data), { mode: 384 });
+		renameSync(tmp, file);
+		chmodSync(file, 384);
+		try {
+			this.loadedMtime = statSync(file).mtimeMs;
+		} catch {}
+	}
+};
+let shared = null;
+function sharedCredentialStore() {
+	if (!shared) shared = new CredentialStore();
+	return shared;
+}
+//#endregion
+export { CredentialStore, authFilePath, dshHome, sanitizeUsername, sharedCredentialStore };
+
+//# sourceMappingURL=credentials.js.map

package/lib/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","names":[],"sources":["../src/credentials.ts"],"sourcesContent":["import { chmodSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs'\nimport { homedir } from 'node:os'\nimport { join } from 'node:path'\nimport { randomBytes, scryptSync, timingSafeEqual } from 'node:crypto'\n\nexport interface AuthStoreData {\n  username: string\n  salt: string\n  hash: string\n  sessionSecret: string\n}\n\nexport function dshHome(): string {\n  return process.env.DSH_HOME ?? join(homedir(), '.dsh')\n}\n\nexport function authFilePath(): string {\n  return join(dshHome(), 'dshb', 'web-auth.json')\n}\n\nexport function sanitizeUsername(input: string): string {\n  return input.replace(/[\\x00-\\x1f\\x7f]/g, '').trim()\n}\n\nexport class CredentialStore {\n  private data: AuthStoreData | null = null\n  private loaded = false\n  private loadedMtime = 0\n\n  private file(): string {\n    return authFilePath()\n  }\n\n  private maybeReload(): void {\n    if (!this.loaded) {\n      this.load()\n      return\n    }\n    try {\n      const mtime = statSync(this.file()).mtimeMs\n      if (mtime !== this.loadedMtime) this.load()\n    } catch {\n      this.data = null\n    }\n  }\n\n  isInitialized(): boolean {\n    this.maybeReload()\n    return this.data !== null\n  }\n\n  get username(): string | null {\n    this.maybeReload()\n    return this.data?.username ?? null\n  }\n\n  get sessionSecret(): Buffer | null {\n    this.maybeReload()\n    return this.data ? Buffer.from(this.data.sessionSecret, 'base64') : null\n  }\n\n  register(username: string, password: string): void {\n    this.maybeReload()\n    if (this.data) throw new Error('auth: already initialized')\n    const salt = randomBytes(16)\n    const hash = scryptSync(password, salt, 64)\n    this.data = {\n      username,\n      salt: salt.toString('base64'),\n      hash: hash.toString('base64'),\n      sessionSecret: randomBytes(32).toString('base64'),\n    }\n    this.save()\n  }\n\n  verify(password: string): boolean {\n    this.maybeReload()\n    if (!this.data) return false\n    const hash = scryptSync(password, Buffer.from(this.data.salt, 'base64'), 64)\n    const expected = Buffer.from(this.data.hash, 'base64')\n    return timingSafeEqual(hash, expected)\n  }\n\n  changePassword(username: string, password: string): void {\n    this.maybeReload()\n    if (!this.data) throw new Error('auth: not initialized')\n    const salt = randomBytes(16)\n    this.data = {\n      username,\n      salt: salt.toString('base64'),\n      hash: scryptSync(password, salt, 64).toString('base64'),\n      sessionSecret: randomBytes(32).toString('base64'),\n    }\n    this.save()\n  }\n\n  changeUsername(username: string): void {\n    this.maybeReload()\n    if (!this.data) throw new Error('auth: not initialized')\n    this.data = { ...this.data, username, sessionSecret: randomBytes(32).toString('base64') }\n    this.save()\n  }\n\n  private load(): void {\n    this.loaded = true\n    const file = this.file()\n    try {\n      this.loadedMtime = statSync(file).mtimeMs\n      const parsed = JSON.parse(readFileSync(file, 'utf8')) as AuthStoreData\n      if (parsed.username && parsed.salt && parsed.hash && parsed.sessionSecret) {\n        this.data = parsed\n      }\n    } catch {\n      this.data = null\n    }\n  }\n\n  private save(): void {\n    const file = this.file()\n    mkdirSync(join(file, '..'), { recursive: true, mode: 0o700 })\n    const tmp = `${file}.${process.pid}.tmp`\n    writeFileSync(tmp, JSON.stringify(this.data), { mode: 0o600 })\n    renameSync(tmp, file)\n    chmodSync(file, 0o600)\n    try {\n      this.loadedMtime = statSync(file).mtimeMs\n    } catch {}\n  }\n}\n\nlet shared: CredentialStore | null = null\n\nexport function sharedCredentialStore(): CredentialStore {\n  if (!shared) shared = new CredentialStore()\n  return shared\n}\n"],"mappings":";;;;;AAYA,SAAgB,UAAkB;CAChC,OAAO,QAAQ,IAAI,YAAY,KAAK,QAAQ,GAAG,MAAM;AACvD;AAEA,SAAgB,eAAuB;CACrC,OAAO,KAAK,QAAQ,GAAG,QAAQ,eAAe;AAChD;AAEA,SAAgB,iBAAiB,OAAuB;CACtD,OAAO,MAAM,QAAQ,oBAAoB,EAAE,CAAC,CAAC,KAAK;AACpD;AAEA,IAAa,kBAAb,MAA6B;CAC3B,OAAqC;CACrC,SAAiB;CACjB,cAAsB;CAEtB,OAAuB;EACrB,OAAO,aAAa;CACtB;CAEA,cAA4B;EAC1B,IAAI,CAAC,KAAK,QAAQ;GAChB,KAAK,KAAK;GACV;EACF;EACA,IAAI;GAEF,IADc,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,YACtB,KAAK,aAAa,KAAK,KAAK;EAC5C,QAAQ;GACN,KAAK,OAAO;EACd;CACF;CAEA,gBAAyB;EACvB,KAAK,YAAY;EACjB,OAAO,KAAK,SAAS;CACvB;CAEA,IAAI,WAA0B;EAC5B,KAAK,YAAY;EACjB,OAAO,KAAK,MAAM,YAAY;CAChC;CAEA,IAAI,gBAA+B;EACjC,KAAK,YAAY;EACjB,OAAO,KAAK,OAAO,OAAO,KAAK,KAAK,KAAK,eAAe,QAAQ,IAAI;CACtE;CAEA,SAAS,UAAkB,UAAwB;EACjD,KAAK,YAAY;EACjB,IAAI,KAAK,MAAM,MAAM,IAAI,MAAM,2BAA2B;EAC1D,MAAM,OAAO,YAAY,EAAE;EAC3B,MAAM,OAAO,WAAW,UAAU,MAAM,EAAE;EAC1C,KAAK,OAAO;GACV;GACA,MAAM,KAAK,SAAS,QAAQ;GAC5B,MAAM,KAAK,SAAS,QAAQ;GAC5B,eAAe,YAAY,EAAE,CAAC,CAAC,SAAS,QAAQ;EAClD;EACA,KAAK,KAAK;CACZ;CAEA,OAAO,UAA2B;EAChC,KAAK,YAAY;EACjB,IAAI,CAAC,KAAK,MAAM,OAAO;EACvB,MAAM,OAAO,WAAW,UAAU,OAAO,KAAK,KAAK,KAAK,MAAM,QAAQ,GAAG,EAAE;EAC3E,MAAM,WAAW,OAAO,KAAK,KAAK,KAAK,MAAM,QAAQ;EACrD,OAAO,gBAAgB,MAAM,QAAQ;CACvC;CAEA,eAAe,UAAkB,UAAwB;EACvD,KAAK,YAAY;EACjB,IAAI,CAAC,KAAK,MAAM,MAAM,IAAI,MAAM,uBAAuB;EACvD,MAAM,OAAO,YAAY,EAAE;EAC3B,KAAK,OAAO;GACV;GACA,MAAM,KAAK,SAAS,QAAQ;GAC5B,MAAM,WAAW,UAAU,MAAM,EAAE,CAAC,CAAC,SAAS,QAAQ;GACtD,eAAe,YAAY,EAAE,CAAC,CAAC,SAAS,QAAQ;EAClD;EACA,KAAK,KAAK;CACZ;CAEA,eAAe,UAAwB;EACrC,KAAK,YAAY;EACjB,IAAI,CAAC,KAAK,MAAM,MAAM,IAAI,MAAM,uBAAuB;EACvD,KAAK,OAAO;GAAE,GAAG,KAAK;GAAM;GAAU,eAAe,YAAY,EAAE,CAAC,CAAC,SAAS,QAAQ;EAAE;EACxF,KAAK,KAAK;CACZ;CAEA,OAAqB;EACnB,KAAK,SAAS;EACd,MAAM,OAAO,KAAK,KAAK;EACvB,IAAI;GACF,KAAK,cAAc,SAAS,IAAI,CAAC,CAAC;GAClC,MAAM,SAAS,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;GACpD,IAAI,OAAO,YAAY,OAAO,QAAQ,OAAO,QAAQ,OAAO,eAC1D,KAAK,OAAO;EAEhB,QAAQ;GACN,KAAK,OAAO;EACd;CACF;CAEA,OAAqB;EACnB,MAAM,OAAO,KAAK,KAAK;EACvB,UAAU,KAAK,MAAM,IAAI,GAAG;GAAE,WAAW;GAAM,MAAM;EAAM,CAAC;EAC5D,MAAM,MAAM,GAAG,KAAK,GAAG,QAAQ,IAAI;EACnC,cAAc,KAAK,KAAK,UAAU,KAAK,IAAI,GAAG,EAAE,MAAM,IAAM,CAAC;EAC7D,WAAW,KAAK,IAAI;EACpB,UAAU,MAAM,GAAK;EACrB,IAAI;GACF,KAAK,cAAc,SAAS,IAAI,CAAC,CAAC;EACpC,QAAQ,CAAC;CACX;AACF;AAEA,IAAI,SAAiC;AAErC,SAAgB,wBAAyC;CACvD,IAAI,CAAC,QAAQ,SAAS,IAAI,gBAAgB;CAC1C,OAAO;AACT"}

package/lib/gate.d.ts

@@ -0,0 +1,14 @@
+import { CredentialStore } from "./credentials.js";
+import { IncomingMessage } from "node:http";
+//#region src/gate.d.ts
+type GateDecision = 'allow' | 'exempt' | 'redirect-login' | 'reject';
+declare class AuthGate {
+  private readonly store;
+  constructor(store: CredentialStore);
+  decide(req: IncomingMessage): GateDecision;
+  private isPageRequest;
+}
+declare function rewriteToLoopback(req: IncomingMessage, port: number): void;
+//#endregion
+export { AuthGate, GateDecision, rewriteToLoopback };
+//# sourceMappingURL=gate.d.ts.map

package/lib/gate.js

@@ -0,0 +1,45 @@
+import { isLoopbackRequest } from "./loopback.js";
+import { SESSION_COOKIE, readCookie, verifySession } from "./session.js";
+//#region src/gate.ts
+var AuthGate = class {
+	store;
+	constructor(store) {
+		this.store = store;
+	}
+	decide(req) {
+		const path = new URL(req.url ?? "/", "http://x").pathname;
+		if (path === "/login" || path.startsWith("/api/auth/")) return "exempt";
+		if (isLoopbackRequest(req.socket.remoteAddress, req.headers.host)) return "allow";
+		const secret = this.store.sessionSecret;
+		const username = this.store.username;
+		if (secret && username) {
+			const value = readCookie(req.headers.cookie, SESSION_COOKIE);
+			if (verifySession(value, secret, username)) return "allow";
+		}
+		if (this.isPageRequest(req)) return "redirect-login";
+		return "reject";
+	}
+	isPageRequest(req) {
+		if (req.method !== "GET" && req.method !== "HEAD") return false;
+		if (new URL(req.url ?? "/", "http://x").pathname.startsWith("/api/")) return false;
+		const accept = req.headers.accept ?? "";
+		return accept.includes("text/html") || accept.includes("*/*");
+	}
+};
+function rewriteToLoopback(req, port) {
+	const authority = `127.0.0.1:${port}`;
+	req.headers.host = authority;
+	for (const name of ["origin", "referer"]) {
+		const value = req.headers[name];
+		if (typeof value !== "string") continue;
+		try {
+			const url = new URL(value);
+			url.host = authority;
+			req.headers[name] = url.toString();
+		} catch {}
+	}
+}
+//#endregion
+export { AuthGate, rewriteToLoopback };
+
+//# sourceMappingURL=gate.js.map

package/lib/gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.js","names":[],"sources":["../src/gate.ts"],"sourcesContent":["import type { IncomingMessage } from 'node:http'\nimport { isLoopbackRequest } from './loopback.js'\nimport { readCookie, SESSION_COOKIE, verifySession } from './session.js'\nimport type { CredentialStore } from './credentials.js'\n\nexport type GateDecision = 'allow' | 'exempt' | 'redirect-login' | 'reject'\n\nexport class AuthGate {\n  constructor(private readonly store: CredentialStore) {}\n\n  decide(req: IncomingMessage): GateDecision {\n    const path = new URL(req.url ?? '/', 'http://x').pathname\n    if (path === '/login' || path.startsWith('/api/auth/')) return 'exempt'\n    if (isLoopbackRequest(req.socket.remoteAddress, req.headers.host)) return 'allow'\n    const secret = this.store.sessionSecret\n    const username = this.store.username\n    if (secret && username) {\n      const value = readCookie(req.headers.cookie, SESSION_COOKIE)\n      if (verifySession(value, secret, username)) return 'allow'\n    }\n    if (this.isPageRequest(req)) return 'redirect-login'\n    return 'reject'\n  }\n\n  private isPageRequest(req: IncomingMessage): boolean {\n    if (req.method !== 'GET' && req.method !== 'HEAD') return false\n    const path = new URL(req.url ?? '/', 'http://x').pathname\n    if (path.startsWith('/api/')) return false\n    const accept = req.headers.accept ?? ''\n    return accept.includes('text/html') || accept.includes('*/*')\n  }\n}\n\nexport function rewriteToLoopback(req: IncomingMessage, port: number): void {\n  const authority = `127.0.0.1:${port}`\n  req.headers.host = authority\n  for (const name of ['origin', 'referer'] as const) {\n    const value = req.headers[name]\n    if (typeof value !== 'string') continue\n    try {\n      const url = new URL(value)\n      url.host = authority\n      req.headers[name] = url.toString()\n    } catch {}\n  }\n}\n"],"mappings":";;;AAOA,IAAa,WAAb,MAAsB;CACS;CAA7B,YAAY,OAAyC;EAAxB,KAAA,QAAA;CAAyB;CAEtD,OAAO,KAAoC;EACzC,MAAM,OAAO,IAAI,IAAI,IAAI,OAAO,KAAK,UAAU,CAAC,CAAC;EACjD,IAAI,SAAS,YAAY,KAAK,WAAW,YAAY,GAAG,OAAO;EAC/D,IAAI,kBAAkB,IAAI,OAAO,eAAe,IAAI,QAAQ,IAAI,GAAG,OAAO;EAC1E,MAAM,SAAS,KAAK,MAAM;EAC1B,MAAM,WAAW,KAAK,MAAM;EAC5B,IAAI,UAAU,UAAU;GACtB,MAAM,QAAQ,WAAW,IAAI,QAAQ,QAAQ,cAAc;GAC3D,IAAI,cAAc,OAAO,QAAQ,QAAQ,GAAG,OAAO;EACrD;EACA,IAAI,KAAK,cAAc,GAAG,GAAG,OAAO;EACpC,OAAO;CACT;CAEA,cAAsB,KAA+B;EACnD,IAAI,IAAI,WAAW,SAAS,IAAI,WAAW,QAAQ,OAAO;EAE1D,IADa,IAAI,IAAI,IAAI,OAAO,KAAK,UAAU,CAAC,CAAC,SACxC,WAAW,OAAO,GAAG,OAAO;EACrC,MAAM,SAAS,IAAI,QAAQ,UAAU;EACrC,OAAO,OAAO,SAAS,WAAW,KAAK,OAAO,SAAS,KAAK;CAC9D;AACF;AAEA,SAAgB,kBAAkB,KAAsB,MAAoB;CAC1E,MAAM,YAAY,aAAa;CAC/B,IAAI,QAAQ,OAAO;CACnB,KAAK,MAAM,QAAQ,CAAC,UAAU,SAAS,GAAY;EACjD,MAAM,QAAQ,IAAI,QAAQ;EAC1B,IAAI,OAAO,UAAU,UAAU;EAC/B,IAAI;GACF,MAAM,MAAM,IAAI,IAAI,KAAK;GACzB,IAAI,OAAO;GACX,IAAI,QAAQ,QAAQ,IAAI,SAAS;EACnC,QAAQ,CAAC;CACX;AACF"}